pal-e-docs

Review: Bug: Woodpecker tfvars_content secret out of sync

review-1612-2026-06-25 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Note: Both READY and APPROVED are accepted as passing verdicts by the check-board-advance hook. Use either keyword interchangeably.

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — Standalone, discovered during Sprint 4
  • [x] Repo — ldraney/pal-e-services
  • [x] What Broke — Woodpecker tfvars_content secret stale after PR #143 merge
  • [x] Repro Steps — 4 steps, clear and reproducible
  • [x] Expected Behavior — Specific resources listed (client, users, roles)
  • [x] Environment — Cluster/namespace, commit SHA, alert status all present
  • [x] Acceptance Criteria — 4 criteria, all testable
  • [x] Related — project-westside-basketball and PR #143 referenced
All required Bug template sections are present and complete.

Traceability

  • [ ] story:superuser-deploy label — WRONG FORMAT. Project page uses story:WS-S* convention. This maps to story:WS-S1 ("As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"). [LABEL] Change story:superuser-deploy to story:WS-S1.
  • [x] story note verified — WS-S1 found in project-westside-basketball user-stories section under Superadmin (Lucas)
  • [ ] arch:ci-pipeline label — present on board item
  • [ ] arch note MISSING — [SCOPE] No arch-ci-pipeline note found in pal-e-docs. Create architecture note arch-ci-pipeline for the Woodpecker CI pipeline component.
  • [x] Forgejo issue — ldraney/pal-e-services#144, state: open

File Targets

No explicit file paths in the issue body. This is an operational bug — the fix is re-encoding the Woodpecker tfvars_content secret and re-triggering the pipeline. No source code changes required. Verified:
  • [x] ~/secrets/pal-e-services/k3s.tfvars — exists locally, contains westside-ror client entries (16 matching lines)
  • [x] k3s.tfvars.example — exists in repo (PR #143 merged these entries)
  • [x] Woodpecker secret tfvars_content — exists on repo ID 45 (confirmed via API)
  • [x] PR #143 — confirmed merged, title matches ("Add westside-ror Keycloak client and seed admin users")
  • [x] Pipeline #53 — confirmed status: failure, event: push, message references PR #143

Repo Placement

Correct. Issue filed on ldraney/pal-e-services, fix is in the pal-e-services Woodpecker secret configuration. No multi-repo concern.

Dependencies

  • Blocks #1605 (Add Keycloak auth with admin/coach/player roles, 5pts, currently in next_up) — this item depends on the Keycloak client being provisioned, which this bug prevents.
  • Caused by #1608 (Add westside-basketball Keycloak client, done) — PR #143 added tfvars entries but the Woodpecker secret was not re-synced.
  • Issue body correctly identifies this as a Sprint 4 blocker.

Acceptance Criteria

4 criteria, all verifiable:
  • AC1: Woodpecker secret updated — verifiable via Woodpecker API (check secret exists and pipeline uses current content)
  • AC2: Pipeline re-triggered and succeeds — verifiable via Woodpecker pipeline status API
  • AC3: westside-ror Keycloak client provisioned — verifiable via Keycloak admin API or UI
  • AC4: Lucas and Marcus seed users created — verifiable via Keycloak admin API or UI
No missing criteria. The scope is tight and well-defined.

Blast Radius

Contained. Only ldraney/pal-e-services uses the tfvars_content secret pattern. No other Woodpecker repos have a similar secret. The fix (re-encoding the secret) has no downstream side effects beyond provisioning the intended resources.
Process gap worth noting: The root cause is a manual step (re-encoding tfvars into Woodpecker secret) that was missed during PR #143. This is a recurring risk any time k3s.tfvars changes. Consider documenting this step in the CI pipeline architecture note when it is created.

Decomposition Assessment

No decomposition needed. 1 point, 0 file changes (operational fix only), 4 AC in a single repo, estimated agent work under 2 minutes. Well within the 5-minute rule.

Recommendation

  • [LABEL] Change story:superuser-deploy to story:WS-S1 on board item #1612 to match project page convention.
  • [SCOPE] Create architecture note arch-ci-pipeline in pal-e-docs for the Woodpecker CI pipeline component. Document the tfvars secret sync process as part of the note.